CVE-2026-54773: CoreWCF Auth Bypass Vulnerability

CVE-2026-54773 Overview

CVE-2026-54773 affects CoreWCF, the .NET Core port of the service side of Windows Communication Foundation (WCF). The vulnerability resides in the WS-Security signature verification logic, which performs a document-wide ds:Signature lookup instead of scoping the search to the security header. An unauthenticated remote attacker can prepend a SOAP header before wsse:Security, causing WSSecurityOneDotZeroReceiveSecurityHeader to validate an attacker-supplied signature rather than the legitimate security header signature. The flaw is tracked as [CWE-347: Improper Verification of Cryptographic Signature]. Fixed releases are CoreWCF 1.8.1 and 1.9.1.

Critical Impact
Unauthenticated remote attackers can forge SOAP messages that pass WS-Security signature verification, compromising message integrity for services relying on signed requests.

Affected Products

CoreWCF versions prior to 1.8.1
CoreWCF versions prior to 1.9.1
.NET Core services implementing WS-Security signed SOAP endpoints via CoreWCF

Discovery Timeline

2026-07-08 - CVE-2026-54773 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-54773

Vulnerability Analysis

CoreWCF implements WS-Security 1.0 processing through the WSSecurityOneDotZeroReceiveSecurityHeader class. During inbound SOAP processing, the receiver locates the ds:Signature element to verify message integrity. In vulnerable versions the lookup traverses the entire SOAP envelope rather than restricting the search to the wsse:Security header. This scoping error causes the verifier to accept any ds:Signature element that appears earlier in the document.

An attacker crafts a SOAP message that includes an additional header positioned before wsse:Security. That attacker-controlled header contains a ds:Signature element the attacker generated over content of their choosing. CoreWCF returns that signature first, validates it successfully, and treats the surrounding message as authenticated. The genuine security header signature is never evaluated.

The result is a signature substitution attack against SOAP endpoints that rely on WS-Security for message authenticity and integrity ([CWE-347]).

Root Cause

The root cause is unscoped XML element resolution. Signature verification code selects ds:Signature from the document scope instead of enforcing that the signature be a direct child of the processed wsse:Security header. Because SOAP allows arbitrary custom headers to precede wsse:Security, an attacker controls which signature is discovered first.

Attack Vector

Exploitation requires only network access to a CoreWCF endpoint that consumes WS-Security signed SOAP messages. No credentials or user interaction are required. The attacker sends a SOAP envelope containing a custom header preceding wsse:Security, embedding a self-generated ds:Signature covering data the attacker wants the service to accept as authentic. The attack complexity is elevated because the attacker must produce a syntactically valid signature and align referenced elements to satisfy XML canonicalization, but no secret material is required.

No verified proof-of-concept code has been published. Refer to the GitHub Security Advisory GHSA-jc6x-rj79-w4mx and the fix commit for technical details.

Detection Methods for CVE-2026-54773

Indicators of Compromise

SOAP requests containing custom or unexpected headers ordered before the wsse:Security header.
Inbound envelopes with multiple ds:Signature elements or ds:Signature elements outside of wsse:Security.
Successful service invocations that reference message content not covered by the security header's declared SignedInfoReference URIs.

Detection Strategies

Inspect SOAP envelopes at the gateway or WAF for the position of wsse:Security relative to other SOAP headers.
Log and alert on requests where ds:Signature elements appear anywhere other than as a direct child of wsse:Security.
Correlate authentication events with the CoreWCF assembly version to identify services running builds earlier than 1.8.1 or 1.9.1.

Monitoring Recommendations

Monitor application logs for anomalous SOAP header sequences and signature verification traces from WSSecurityOneDotZeroReceiveSecurityHeader.
Track deployments of the CoreWCF NuGet package and flag services pinned to versions below the fixed releases.
Baseline expected SOAP header structures per endpoint and alert on structural deviations.

How to Mitigate CVE-2026-54773

Immediate Actions Required

Upgrade CoreWCF to 1.8.1 or 1.9.1 immediately for any service that processes WS-Security signed messages.
Enumerate all internal and external SOAP endpoints running CoreWCF and confirm the assembly version in production.
Restrict network access to affected services until patching completes, especially where endpoints are internet-facing.

Patch Information

The issue is fixed in CoreWCF v1.8.1 and CoreWCF v1.9.1. The corrective changes constrain signature lookup to the wsse:Security header scope. Review the fix commits: 0589692, 30aef80, and 4618f24.

Workarounds

Enforce a strict SOAP schema at an upstream gateway that rejects envelopes containing headers preceding wsse:Security.
Reject inbound messages that contain more than one ds:Signature element or any ds:Signature outside wsse:Security.
Require transport-layer authentication such as mutual TLS in addition to WS-Security until the patch is applied.

bash

# Update CoreWCF NuGet package to a patched version
dotnet add package CoreWCF.Primitives --version 1.9.1
dotnet add package CoreWCF.Http --version 1.9.1
dotnet add package CoreWCF.WebHttp --version 1.9.1

# Verify installed version
dotnet list package | grep -i CoreWCF